MDE Toolkit 3.4.0

• Release artifacts are now digitally signed, so you can verify what you downloaded before you deploy it to a fleet.
• Smart App Control reporting bug is fixed that had wrong status.
• EDR onboarding added to the Overview page,
• Application icon updated.

MDE Toolkit 3.3.4

Fixed Background Sync: Scheduled uploads acquire tokens through the Windows broker (WAM), which is the only provider that can redeem the machine’s Entra PRT. On a joined or registered device this is silent and uses the correct identity. The interactive browser is now excluded outright from every code path the background collector uses, and automatic authentication is disabled on the broker itself, so a machine that cannot sign in silently fails and logs a reason instead of rendering a window nobody will ever see.

MDE Toolkit 3.3.3

Updates to the website Enterprise page and PowerBI: https://mdetoolkit.org/enterprise-setup.html

PowerBI fleet dashboard built from the template, connected to live Azure Table Storage. Headline numbers across the top, status breakdown and a one-row-per-device table in the middle, control coverage along the bottom.

• Updated background collector for Function App data.

MDE Toolkit 3.3.2

• Attack Surface Reduction release. The ASR page becomes a two-page workspace — an overview that finally tells you what mode every rule is in and where that configuration came from, and a new Events page for investigating blocks and tuning them. Admins can create audited, expiring exclusions directly from an event.

🐛 Fixes

• Temporary exclusions never expired. Remove-MpPreference matches the ASR rule ID case-sensitively — given the wrong case it exits 0, logs nothing, and removes nothing. The expiry sweep normalised the GUID to lowercase, so every temporary exclusion silently outlived its expiry. Defender keeps whatever case was originally written, so the toolkit now reads the stored ID back and echoes its exact casing. A failed revert is also retried on the next sweep instead of being stranded permanently.
• Exclusion counts were badly under-reported. Get-MpPreference returns rule-specific exclusions |-separated while the registry uses >; only the latter was handled, so a rule with ten excluded paths counted as one.
• Overlapping exclusions no longer corrupt each other. Defender keys exclusions by (rule, path) with no reference count, so two ledger entries shared one Defender entry, an expiring temporary exclusion could silently revoke a permanent one. Expiry is now reference-aware and duplicates are blocked at creation.
• Collection interval mismatch. The code default was 60 minutes while the documentation, the installer seed and the scheduled-task cadence all said 480 (8 hours), so MSI-installed devices collected every 8 hours but devices without the registry value collected hourly. The code now matches at 480.
• Render-thread crashes are survivable. The application had no global exception handling, so a transient GPU driver or display-topology fault (UCEERR_RENDERTHREADFAILURE) terminated the process mid-investigation. These are now absorbed and logged to %LOCALAPPDATA%\MDE-Toolkit\diagnostics.log, falling back to software rendering only after repeated failures. Other exceptions are logged but deliberately not suppressed.
• Fixed a crash (NullReferenceException in ListCollectionView.PrepareLocalArray) when loading ASR data.

🔒 Enterprise guardrails for ASR exclusions
New optional policy values under HKLM\SOFTWARE\Policies\MDE-Toolkit restrict what admins may create. A device with none of them set behaves exactly as before.

• AsrAllowPermanentExclusions (DWORD, default 1) — 0 forces every exclusion to expire.
• AsrAllowTemporaryExclusions (DWORD, default 1) — set both flags to 0 to disable exclusion creation entirely.
• AsrExclusionMaxHours (DWORD, default 0 = uncapped) — hard cap, applied last so it cannot be widened by the list below.
• AsrExclusionDurationsHours (SZ, default 4,24,168,720) — custom duration menu; unparseable entries are ignored and reported rather than silently dropped.
• ForceReadOnlyMode was previously documented but never enforced. It now blocks every exclusion write, creation and removal alike.
• Enforcement happens in the apply path, not just the dropdown, so the policy is not merely cosmetic. Temporary-only with a four-hour cap is two values: AsrAllowPermanentExclusions=0 and AsrExclusionMaxHours=4.

🔒 Two flags now actually work

• DisableRemoteTarget now pins the toolkit to the local machine. Enforcement sits in the TargetMachine setter rather than on the text box, because that setter is the single choke point every remote-capable service reads from — roughly thirty services branch on it. A non-local value is rejected and coerced back to localhost, so no remote path is reachable even if a future caller sets the target in code. The Target box is also disabled, with a tooltip naming the policy.
• DisableExportButtons now blocks every export path: report PDF/HTML, triage report, scan results, ASR event CSV, Advanced Hunting CSV and XML, supplemental and merged App Control policies, WDAC XML, firewall migration JSON, and investigation details CSV. Blocked attempts show a dialog naming the policy, so the button does not simply appear broken.

MDE Toolkit 3.2.1

Highlights

• Major App Control / WDAC workflow upgrade
• New Advanced Hunting deep-dive tools for policy impact analysis
• New interactive export report experience with PDF, HTML, JSON, and redaction options
• New Policy Diff / Merge workflow
• Improved fleet-impact querying for large tenants
• Better local policy discovery, including active WDAC policies and optional EFI policy locations
• Improved background collection and upload schema for enterprise reporting

App Control and WDAC

• Added a deeper App Control workflow with:
  • Vendor / product picker for Advanced Hunting scoping
  • Policy impact scanner for local files
  • Policy comparison against loaded WDAC policies
  • Fleet impact mode for tenant-wide would-block analysis
  • Policy diff / merge popup for comparing multiple policies
• Added clearer per-policy status:
  • Audit vs Enforced
  • Signed policy indicators
  • Improved handling for supplemental policies inheriting base-policy mode
• Enhanced WDAC policy page:
  • Added policy status display
  • Added optional EFI policy scanning
  • Improved local active policy discovery
  • Better support for .cip, .p7b, and XML policy sources

Advanced Hunting

• Added support for both Microsoft Graph Advanced Hunting and direct MDE API authentication paths.
• Added local-policy and custom-folder policy loading.
• Added option to exclude already-covered policy rules from generated KQL so results focus on gaps.
• Added a guided Advanced Hunting walkthrough.
• Improved fleet-impact queries:
  • Aggregates by unique binary
  • Tracks distinct impacted devices
  • Adds event count rollups
  • Uses sharded/adaptive query execution to avoid large-tenant result-size and timeout failures
  • Handles retryable failures more gracefully

Exporting and reporting

• Replaced the old ticket PDF flow with a new Export Report dialog.
• Added output format options:
  • PDF only
  • HTML only
  • Both PDF and HTML
  • Optional raw JSON snapshot
• Added report section selection with all/none shortcuts.
• Added redaction options for:
• Machine/current user
• UPN/email addresses
• IP addresses
• Serial number placeholder
• Redesigned PDF output with:
  • Dashboard verdict page
  • Table of contents
  • Bookmarks
  • Repeating table headers
  • Footer with machine/timestamp/page numbers
• Added new self-contained HTML report:
  • Searchable
  • Sortable tables
  • Collapsible sections
  • Sticky navigation
  • Dark-mode support
  • Print-friendly styling
• Modernized triage report HTML to match the new report style.
• Added CLI parity for report export:
  • --export-html
  • --format
  • --include-json
  • --redact
  • --include-sections

Knowledge Base and scoring

• Added Knowledge Base navigation/content for application guidance.
• Fixed PUA Protection security-score handling.
• Added cross-reference guidance from App Control areas into the KB.

CAB / compliance / grid fixes

• Fixed CAB/event insight grid usability:
  • Re-enabled virtualization
  • Improved scrolling
  • Added sortable columns
  • Added row details for long content
• Fixed compliance grid behavior:
  • Better sorting
  • Improved scrolling
  • Added expandable details for notes/details

Background collection and enterprise upload

Latest branch changes after the 3.2.1 bump improve the collect/upload path:

• Background collector now flattens summary fields into the root JSON payload for easier Function App and Azure Table mapping.

• Added more collected summary fields:

  • Platform version
  • Engine/signature versions
  • Scan timestamps
  • IP address
  • last boot time
  • MDE Org ID
  • device tag / org unit / environment label

• Added registry/filesystem fallbacks for Defender version and scan data when CIM/WMI is unavailable under SYSTEM.

• Improved App Control status detection by checking deployed .cip policy count and enforcement/audit state.

• Improved Function App ingestion with new table fields:

  • DeviceTag
  • OrgUnit
  • Environment
  • PlatformVersion

Fixes

• Fixed Advanced Hunting export and policy comparison issues.
• Fixed large Advanced Hunting pulls by sharding fleet-impact queries.
• Fixed PDF/HTML report inconsistencies.
• Fixed empty HTML policy/device-control report tables.
• Fixed Policy Diff picker scrolling/minimum size.
• Fixed export settings window layout.
• Fixed App Control audit/enforced counters.
• Fixed signed .cip detection display.
• Fixed CAB and compliance grid scrolling/sorting issues.

MDE Toolkit 3.2.0

App Control Deep-Dive

A workflow-focused release that adds six Application Control features and a
completely new ticket-attachment export pipeline for Tier II / III support.

Highlights

Fixes

• UI regex characters Removed regex characters from UI

🔍 Six new App Control features

• Vendor & Product picker for Advanced Hunting — scope Day-1 hunts to a
  specific publisher/product without hand-writing KQL.
• Audit-mode banner + per-policy Mode/Signed columns on the Overview
  page so you can see at a glance whether policies are enforced, in audit,
  and CMS-signed.
• Impact Scanner (renamed from File Scanner) — load any policy,
  scan a folder / the local machine, and see predicted allow/block/audit
  outcomes. Includes a guided tour on first use.
• Fleet Impact toggle in Advanced Hunting — a single click switches AH
  to a unique-binary, device-aggregated view that answers "should I deploy
  this policy?" with would-block %, devices affected, and top vendors.
• Policy Diff & Merge popup — compare N loaded policies (In-All /
  Only-in-some / Conflict) and merge them into a single fresh SiPolicy XML.
• PDF ticket reports — completely redesigned first-page dashboard with
  HEALTHY / REVIEW / DEGRADED verdict, TOC with real page numbers, per-WDAC
  bookmarks, repeating table headers, alternating row bands.

📎 New Export Report dialog (replaces "Save PDF for ticket…")

• Format: PDF only / HTML only / Both.
• Sections: 19 checkboxes with All / None shortcuts.
• Redaction: machine name, UPN, IP addresses.
• Extras: also emit raw JSON snapshot.
• Post-actions: open when done / reveal in Explorer.
• Preferences persist across launches
  (%LocalAppData%\MDE-Monitoring-App\export-prefs.json).

🌐 HTML export (new)

Single self-contained .html file — no frameworks, no external assets:

• Sticky toolbar with page-wide search, Expand/Collapse-all, Print.
• Sticky TOC that jumps cleanly to sections.
• Every section is a <details> — WDAC policies collapse by default so
  a 20-policy machine still opens on one screen.
• Sortable tables — click any header (numeric columns detected).
• Dark-mode CSS via prefers-color-scheme.
• Print stylesheet strips interactive chrome for clean printouts.

📝 Triage Report HTML modernized

Same visual language as the Export Report — dark-mode, sticky TOC, verdict
banner, collapsible sections, sortable tables, in-page search. Markdown
output is unchanged for pasting into ticket bodies.

🖥️ CLI parity with the GUI

--export-html, --format, --include-json, --redact,
--include-sections all wired through the same pipeline as the GUI.
Batch mode (--machines-file) honours every new flag. Backwards compatible:
--export-pdf alone still produces exactly one PDF.

MDE Toolkit 3.1.2

• Recommendations skip rule levels they can't honestly satisfy from AH data (no more placeholder , no more REPLACE_WITH_ROOT_TBS_HASH signers).
• New ManualReview sentinel for events with zero usable metadata — surfaced in the grid, excluded from exports.
• Policy export now merges into one of four Microsoft WDAC Wizard templates (Empty Supplemental / Default Windows / Allow Microsoft / Signed and Reputable) with proper / / wiring (UMCI=12, KMCI=131) so the resulting AllowMicrosoft.xml actually enforces rules.
• New "Auto-compile to .cip after export" checkbox runs ConvertFrom-CIPolicy and drops the .cip next to the AllowMicrosoft.xml.
• Hash rules now emit both SHA256 + SHA1; FileName rules now valid .
• Per-policy coverage credits every policy that allowed an event
• Risk badge follows the recommended rule type instead of just file location.
• Policy comparer evaluates against all selected policies with Deny-overrides-Allow precedence.

MDE Toolkit 3.1.1

New App Control for Business → Advanced Hunting sub-page that pulls live WDAC events from Microsoft Defender for Endpoint, compares them against your local or custom App Control policies, and recommends the right allow rules to author — with the same -Level / -Fallback precedence semantics as PowerShell New-CIPolicy.

✨ New: App Control for Business - Advanced Hunting

• Direct Advanced Hunting integration. Sign in with MSAL and pull WDAC events (DeviceTvmInfoGathering, audit / enforced blocks, signing-info, script blocks) from the Microsoft Defender for Endpoint Advanced Hunting API. All four sovereign clouds are supported out of the box: Commercial, US Gov GCC, US Gov GCC High, and US Gov DoD — the right endpoint and authority host are picked automatically.
• KQL editor + presets. Built-in editor with one-click presets (All / Blocks only / Audits only / Scripts only / Signing info) that swap the ActionType filter via regex so your custom WHERE clauses survive. Save / load .kql files to share queries with the team.
• Compare against local or custom policies. Load every .cip in C:\Windows\System32\CodeIntegrity\CIPolicies\Active plus SiPolicy.p7b in one click, or browse to a folder of .cip / .p7b / .xml policies (recursive optional). Each event is evaluated as Allowed, Denied (explicit), or Would Still Block across every selected policy. Explicit Deny wins over Allow anywhere in the set, matching how WDAC merges policies at runtime.
• Action plan card. Rolls up the unresolved events into a plain-English plan: how many unique Publisher / FileAttribute / FilePath / Hash rules you’ll need to author, how many Microsoft-signed / kernel / script events were filtered out, and which policies are doing the heavy lifting (per-policy coverage bar).

🔀 Rule precedence (PowerShell -Level / -Fallback)
All 13 documented file-rule levels are supported. Hash, FileName, FilePath, SignedVersion, Publisher, FilePublisher, LeafCertificate, PcaCertificate, RootCertificate, WHQL, WHQLPublisher, WHQLFilePublisher, and PFN.
Admin-configurable precedence. The Policies side-drawer has a new Rule precedence expander with a single list of all 13 levels. Drag rows to re-rank them; the top entry becomes -Level and the rest become -Fallback in order. A live Consolas-styled preview shows the resulting PowerShell-equivalent command. Order is persisted to %LOCALAPPDATA%\MDE-Toolkit\advanced-hunting-prefs.json.
The recommender walks your order, not a hard-coded one. For each event the comparer picks the first level the Advanced Hunting data actually has enough metadata to satisfy - just like New-CIPolicy. Defaults to Microsoft’s recommended FilePublisher → Publisher → SignedVersion → FileName → Hash → FilePath on first launch.
Hash > FilePath when both are available. Hash pins exact bytes, so it’s now preferred over FilePath even for admin-only folders. FilePath only wins when the event has no usable hash at all.

MDE Toolkit 3.1.0

✨ What's New

• Smooth page scrolling everywhere. The mouse wheel now scrolls the page even when the cursor is hovering over a grid, text box, expander, or any nested control — no more having to move the cursor onto the background to scroll.
• Smooth grid scrolling when rows are expanded. Clicking a row to view its details (for example ASR Rules → per-rule exclusions, WDAC Policies, MDE Support → Issues, App Control events) used to make the scrollbar thumb shrink and the first wheel notch jump past most of the rows. The thumb now stays a consistent size and both wheel and drag scrolling are smooth straight through the expanded row.
• Refreshed Quick Actions icon. The gpupdate /force button now uses a "document with text" icon for better visual clarity.
• Added Quick Actions, Health Snapshot and Live Events for troubleshooting.
• Added Event ID information under Knowledge Base

🛠️ Under the Hood

• New app-wide mouse-wheel routing helper installed at startup. Every window (Main, AI Analysis, AI Settings, Compliance Manager, Advanced Networking, Export Settings) benefits from the same smooth scrolling with no per-page configuration.
• Row virtualization disabled and pixel-based scrolling enabled on the 15 grids that show expandable row details. Grids hold at most a few hundred rows in this app, so there is no measurable startup cost.
• Bumped application, installer, About screen, and website to 3.1.0.

MDE Toolkit 3.0.9

Firewall → Intune Migration
Resolved built-in rule names and descriptions. Built-in Windows Firewall rules store their Name, Description, and Group fields in the registry as MUI indirect references (e.g. @FirewallAPI.dll,-37507). Previous releases passed those raw references through to the migrated Intune Settings Catalog policies, leaving rules with unreadable names.

This release adds a MuiStringResolver that calls SHLoadIndirectString(string, StringBuilder, int, IntPtr) (the same Win32 API used by wf.msc and Get-NetFirewallRule) to translate those references into their real localized strings. Resolution happens at parse time for both the registry and WMI paths, with results cached for performance.

What you'll see:
• Firewall rule list now shows friendly names like "Cast to Device functionality (qWave-TCP-In)" instead of @FirewallAPI.dll,-37507
• Exported Intune Settings Catalog JSON now contains real names and descriptions in the _name and _description child settings
• Works for Local, GPO, and MDM policy stores
• Falls back to the original string if a DLL is missing or a resource ID is invalid (rules still migrate)

Support Bundle / Diagnostics
New: dedicated MDEClientAnalyzerResult.zip analyzer
The diagnostics workflow now has two analyzer services — one for MpCmdRun -GetFiles CABs and a new one (MdeAnalyzerService) tuned for the much richer MDEClientAnalyzerResult.zip produced by the MDE Client Analyzer. The new analyzer extracts the ZIP and parses:
• Analyzer XML, onboarding info, and onboarding policy
• Connectivity test results (MDETestResult.txt, MDEClientAnalyzerTest.txt)
• dsregcmd /status output
• Security management config (Intune/MDE-managed)
• All .evtx event logs (recursive) — Application, System, Security, Sense, UTC, MDM, PowerShell, WMI, AAD, Code Integrity, Defender Operational, etc.
• System info logs and component versions
• Certificate validation and SCHANNEL configuration
• Proxy configuration (WinHTTP, WPAD, IE)
• Enforcement reports
• Service status (service.txt, service list)
• MpComputerStatus.txt — RTP state, tamper protection, signature/scan age
• MpPreference.txt — exclusions, MAPS, sample submission, cloud block, PUA, IOAV, network protection
• hosts file
• Running processes (process.txt)
• Crash dumps (SenseCE_, SenseNdr_, SenseTVM_, etc.) — surfaced as critical issues
• Effective config (MPSupportEffectiveConfig.json)
• Defender AV policy text exports
• Device Guard settings and Network Protection diagnostic state
• npdiag logs and RegOffboardingInfo.json

Event Logs tab — full coverage
All .evtx files in the bundle (CAB or ZIP) are now imported into the shared event collection. Each event tracks its source file, provider, ID, level, timestamp, and full message text. Per-file capacity raised to 10,000 events and message truncation removed so row expansion shows complete details.